CVE-2026-63860 addresses a vulnerability in the Linux kernel's RDMA core where attributes evaluated as C-strings were handled using NLA_STRING, which does not enforce the presence of a null terminator. This could lead to unsafe string operations such as strcmp on non-null-terminated data. The fix involves switching to NLA_NUL_STRING or using nla_strcmp() with adjusted printf format specifiers to ensure safe string handling. This vulnerability is included in a large set of Linux kernel security fixes covering numerous subsystems and architectures. The vulnerability affects linux-aws kernel versions prior to several 5.15.0-xxx releases as specified. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector with low complexity and no privileges or user interaction required, resulting in high impact on confidentiality, integrity, and availability.

The vulnerability allows a local attacker to exploit unsafe string handling in the RDMA core subsystem of the Linux kernel, potentially leading to memory safety issues that can compromise system confidentiality, integrity, and availability. The CVSS score of 8.4 reflects a high-severity impact. This issue is part of a broader set of kernel vulnerabilities that could be used to compromise the system if exploited.

A patch is available and has been released by the vendor. Users should apply the official Linux kernel updates provided by their distribution, specifically the linux-aws kernel updates that include this fix. After updating, a system reboot is required to apply the changes. Due to an ABI change, recompilation and reinstallation of all third-party kernel modules are necessary. Follow the vendor's update instructions carefully to ensure full remediation.